spaces/web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

implemented secure remember me functionality

Browse Source
This commit is contained in:
jashton
2025-03-31 23:39:40 -06:00
parent e65d679dcf
commit b9bb620ae0
5 changed files with 49 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
functions/account_functions.php
+19 -8
View File
@@ -41,7 +41,6 @@ function cookies($user, $time)
function logout()
{
foreach (array_keys($_COOKIE) as $key) {
echo 'unsetting ' . $key . ' now.';
setcookie($key, '', time() - 3600, '/');
unset($_COOKIE[$key]);
}
@@ -93,13 +92,19 @@ function login($username, $password, $stay_logged_in)
return $error_msg;
}
if ($stay_logged_in)
$time = time() + 60 * 60 * 24 * 365;
else
$time = time() + 60 * 60 * 24 * 1;
$time = time() + 60 * 60 * 1;
cookies($user, $time);
if ($stay_logged_in) {
$token = bin2hex(random_bytes(64));
// echo $token . '<br>';
// echo strlen($token);
setcookie('remember_user', $token, time() + 60 * 60 * 24 * 30, '/', '', true, true);
$stmt = 'INSERT INTO remember_user (token, user_id, remote_addr' . (isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? ', http_forward' : '') . ') VALUES ("' . $token . '", ' . $user['user_id'] . ', "' . hash('sha256', $_SERVER['REMOTE_ADDR']) . '"' . (isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? ', "' . hash('sha256', $_SERVER['HTTP_X_FORWARDED_FOR']) . '"' : '') . ');';
exec_statement($stmt, 1);
}
return true;
}
@@ -439,7 +444,10 @@ function delete_account($user_id, $password = null, $verify_password = null)
return $error_msg;
}
delete_file($_ENV['PROFILE_IMAGES_FQ_PATH'] . $user['profile_picture']);
// Hardcoded prevention of deleting the owner's profile picture
if ($user['profile_picture'] != '2025.jpg')
delete_file($_ENV['PROFILE_IMAGES_FQ_PATH'] . $user['profile_picture']);
$stmt = 'DELETE FROM user WHERE user_id = ' . $user_id . ';';
exec_statement($stmt, 1);
logout();
@@ -457,7 +465,10 @@ function delete_account($user_id, $password = null, $verify_password = null)
return $error_msg;
}
delete_file($_ENV['PROFILE_IMAGES_FQ_PATH'] . $user['profile_picture']);
// Hardcoded prevention of deleting the owner's profile picture
if ($user['profile_picture'] != '2025.jpg')
delete_file($_ENV['PROFILE_IMAGES_FQ_PATH'] . $user['profile_picture']);
$stmt = 'DELETE FROM user WHERE user_id = ' . $user_id . ';';
exec_statement($stmt, 1);
}